Preserving high value entries in an event log

ABSTRACT

A first entry is received at an event log interface. The event log interface is configured to store received entries in an event log. It is determined that there is not enough storage space to store the first entry in the event log. A second entry is identified. The second entry is the oldest entry in the event log based on when the second entry was written to the event log. It is determined that the second entry contains an indicator to preserve. A copy of the second entry is sent to the event log interface to be written to the event log. One or more entries are deleted from the event log. The one or more entries includes the second entry. The first entry is written to the event log. The copy of the second entry is written to the event log.

BACKGROUND

The present disclosure relates to computing event logs, and morespecifically, to preserving high value events in an event log.

A common design point for event logs is to wrap out the oldest entrieswhen space is exhausted so that new entries can be added. In thiscontext the “oldest entries” refers to the order in which they wereentered into the event log and not the time stamp of the entry. Managingthe log space with this “First In, First Out” design point is relativelyeasy. Entries are removed starting from the point in the storage areawhere the oldest entry is until there is enough space available for anew entry to be inserted. The specific implementation can vary. Thisdesign point is focused on making enough contiguous space by deletingentries from the oldest towards the more recent entries until enoughspace is available for a new entry to be inserted next to the mostrecent entry.

SUMMARY

According to embodiments of the present disclosure, a method formanaging an event log is described. A first entry is received at anevent log interface. The event log interface is configured to storereceived entries in an event log. It is determined that there is notenough storage space to store the first entry in the event log. A secondentry is identified. The second entry is the oldest entry in the eventlog based on when the second entry was written to the event log. It isdetermined that the second entry contains an indicator to preserve. Acopy of the second entry is sent to the event log interface to bewritten to the event log. One or more entries are deleted from the eventlog. The one or more entries includes the second entry. The first entryis written to the event log. The copy of the second entry is written tothe event log.

Further described herein are embodiments of a computer program productfor managing an event log. The computer program product includes acomputer readable storage medium having program instructions embodiedtherewith, wherein the computer readable storage medium is not atransitory signal per se. The program instructions are executable by acomputer to cause the computer to perform a method. As part of themethod, a first entry is received at an event log interface. The eventlog interface is configured to store received entries in an event log.It is determined that there is not enough storage space to store thefirst entry in the event log. A second entry is identified. The secondentry is the oldest entry in the event log based on when the secondentry was written to the event log. It is determined that the secondentry contains an indicator to preserve. A copy of the second entry issent to the event log interface to be written to the event log. One ormore entries are deleted from the event log. The one or more entriesincludes the second entry. The first entry is written to the event log.The copy of the second entry is written to the event log.

Further described herein are embodiments of a system for managing anevent log. The system includes one or more processors, one or morecomputer-readable memories, one or more computer-readable tangiblestorage devices, and program instructions stored on at least one of theone or more storage devices for execution by at least one of the one ormore processors via at least one of the one or more memories. Theprogram instructions are configured to cause the system to perform amethod. As part of the method, a first entry is received at an event loginterface. The event log interface is configured to store receivedentries in an event log. It is determined that there is not enoughstorage space to store the first entry in the event log. A second entryis identified. The second entry is the oldest entry in the event logbased on when the second entry was written to the event log. It isdetermined that the second entry contains an indicator to preserve. Acopy of the second entry is sent to the event log interface to bewritten to the event log. One or more entries are deleted from the eventlog. The one or more entries includes the second entry. The first entryis written to the event log. The copy of the second entry is written tothe event log.

The above summary is not intended to describe each illustratedembodiment or every implementation of the present disclosure.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

The drawings included in the present application are incorporated into,and form part of, the specification. They illustrate embodiments of thepresent disclosure and, along with the description, serve to explain theprinciples of the disclosure. The drawings are only illustrative ofcertain embodiments and do not limit the disclosure.

FIG. 1 depicts a flow diagram of an example method for handling areceived entry at an event log interface.

FIG. 2 depicts a flow diagram of an example method for handling deletionof entries in an event log to create room for an entry to be added.

FIG. 3 depicts a flow diagram of an example method for modifying anentry in an event log.

FIG. 4 depicts a block diagram of an example system for maintaining anevent log that preserves high value entries.

FIG. 5 depicts a high-level block diagram of an example system forimplementing one or more embodiments of the invention.

While the invention is amenable to various modifications and alternativeforms, specifics thereof have been shown by way of example in thedrawings and will be described in detail. It should be understood,however, that the intention is not to limit the invention to theparticular embodiments described. On the contrary, the intention is tocover all modifications, equivalents, and alternatives falling withinthe spirit and scope of the invention.

DETAILED DESCRIPTION

Aspects of the present disclosure relate to retaining high value evententries in an event log, and more particular aspects relate to copyinghigh value event entries to reenter into an event log before deletingthe high value entries using a First In, First Out method. While thepresent disclosure is not necessarily limited to such applications,various aspects of the disclosure may be appreciated through adiscussion of various examples using this context.

It is not uncommon for event logs to get so much activity that they wrapout entries more quickly than desired. Some of those entries are ofhigher value or higher importance for addressing problems. It may bebeneficial to retain certain entries for a longer period of time. Forexample, it may be important to retain entries relating to failures of asystem, such as a failure to access a database, until the failure isfixed. These “high value” entries may be deleted before the issue can befixed in a typical First In, First Out event log.

Embodiments of the present invention may provide for retaining highvalue entries in an event log using a modified First In, First Outmethod. An event log interface may handle incoming entries to be addedto the event log. New event log entries may be processed to addinformation to the entries such as a timestamp, ID, or sequence value.The entries may also be checked to determine if they are high valueentries. There may be a list of specific events or event types which isused to determine whether an entry is a high value entry. For example,an entry associated with an event on the list, such as a failure toaccess a database, may be a high value entry. An indicator to preservethe entry may be added to high value entries. The indicator to preservemay be any indicator, such as a specific string of one or morecharacters added to the entry.

When the event log is full and an entry is to be added to the event log,the First In, First Out method may be used to identify one or moreentries to be deleted. If the entry to be deleted contains an indicatorto preserve, a copy of the entry may be made and sent to the event loginterface to be entered in to the event log again before deleting theoriginal entry from the event log.

The event log interface may check incoming entries to determine if theentry is a new entry or a copy of a previous entry. This may be done,for example, by identifying an indicator to preserve in the receivedentry. New entries may be treated differently than copies of previousentries. For example, information may be added to new entries such as atimestamp, identification value, or sequence number and copies ofprevious entries may be written to the event log “as-is” because thecopies already contain this information. Particularly, the previoustimestamp may be retained such that the timestamp represents when theevent occurred that is associated with the entry.

User interfaces or functions which provide a chronological view or listof events may sort events by timestamp rather than using the order thatthe entry was entered into the event log as the order that the entriesas they were written into the event log may not represent the actualorder of the events when some entries are copies of previous entries.

In some embodiments, identifying an entry to copy and send to the eventlog interface may involve more than just identifying an indicator topreserve. For example, in some embodiments, a copy may not be madeunless entries with an indicator to preserve account for less than aspecified amount of the storage space for the event log (e.g. less than50%). Further, in some embodiments, a copy may not be made unless theevent occurred within a specified period of time. For example, the copymay be made if the entry has a timestamp indicating it is not more than2 years old. These extra requirements for copying an entry may help toprevent the event log from becoming stuck trying to add new entries whenthe event log is full of entries with an indicator to preserve.

In some embodiments, entries which are modified will be checked again todetermine if they meet the criteria to preserve after the modification.An indicator to preserve the entry may be added to the entry or removedfrom the modified entry if the entry's status changes with regard to thecriteria to preserve. For example, an entry may be associated with anerror which occurred and the entry may contain an indicator to preserve.The entry may also contain an indicator that the issue has not beenresolved. Once the issue is resolved, the entry may be modified toremove the indicator that the issue has not been resolved. When theentry is checked again after being modified, the entry may no longermeet the criteria to preserve. If the criteria to preserve an entry areno longer met, the indicator to preserve the entry may be removed.

Referring to FIG. 1, a flow diagram of an example method 100 forhandling a received entry at an event log interface is depicted. Method100 starts at block 105. At block 110, an event entry is received at theevent log interface. The entry may be a new entry received from a clientor a copy of a previous entry from the event log. At block 115, it isdetermined whether the entry is a copy of a previous entry. In someembodiments, this may include determining whether the entry contains anindicator to preserve the entry as previous entries which are receivedby the event log interface may contain an indicator to preserve.

If the entry is not a copy of a previous entry, method 100 proceeds toblock 120 and adds information to the entry. The information may includea timestamp, identification value, a sequence number, or any otherinformation which may be added to the entry to be written in the eventlog. If the entry is a copy of a previous entry, method 100 skips block120 and proceeds to block 125. This allows the copy of the previousentry to retain the information added when the original entry wasreceived at the event log interface. For example, the copy of the entrymay retain the timestamp of the original entry.

At block 125, it is determined whether there is enough space for theentry in the event log. If there is not enough room in the event log,method 100 proceeds to block 130 and deletes one or more entries in theevent log to make room. An example method for deleting the entries isdescribed herein in reference to FIG. 2. If there is enough room in theevent log, method 100 skips block 130 and proceeds to block 135. Atblock 135, the entry is written to the event log.

At block 140, it is determined whether the entry contains an indicatorto preserve. An entry may contain an indicator to preserve if it is acopy of a previous entry. If the entry contains an indicator topreserve, method 100 proceeds to block 155 and ends. If the entry doesnot contain an indicator to preserve, method 100 proceeds to block 145.At block 145, it is determined whether the entry meets criteria topreserve. Determining whether the entry meets the criteria to preservemay include determining whether the event associated with the entry isincluded in a list of events to preserve. If the entry does not meet thecriteria to preserve, method 100 proceeds to block 155 and ends. If theentry meets the criteria to preserve, method 100 proceeds to block 150and adds an indicator to preserve to the entry.

Referring to FIG. 2, a flow diagram of an example method 200 forhandling deletion of entries in an event log to create room for an entryto be added is depicted. Method 200 begins at block 210. Method 200 maybegin in response to determining that a new entry is to be written inthe event log and that there is not enough space for the entry in theevent log. At block 220, an entry to be deleted is identified based on aFirst In, First Out method. Thus, of the entries in the event log, theentry which was entered first is identified.

At block 230, it is determined whether the entry contains an indicatorto preserve. If the entry does not contain an indicator to preserve,method 200 proceeds to block 270 and deletes the entry. If the entrycontains an indicator to preserve, method 200 proceeds to block 240.

At block 240, it is determined whether the amount of storage space inthe event log containing entries with an indicator to preserve is belowa specified amount. If the amount of “preserve” storage space in theevent log is not below the specified amount, method 200 proceeds toblock 270 and deletes the entry. If the amount of “preserve” storagespace in the event log is below the specified amount, method 200proceeds to block 250.

At block 250, it is determined whether the event associated with theentry is an old event. For example, determining an event is an old eventmay include determining the period of time since the original entryassociated with the event was received at the event log interface, usingthe timestamp in the entry, and determining the period of time isgreater than a specified period of time. If the event is an old event,method 200 proceeds to block 270 and deletes the entry. If the event isnot an old event, method 200 proceeds to block 260 and sends a copy ofthe entry to the event log interface to be entered into the event logbefore proceeding to block 270 and deleting the entry.

At block 280, after deleting the entry, it is determined whether thereis room in the event log for the new entry. If there is not room, method200 returns to block 220. If there is enough room, method 200 proceedsto block 290 and ends.

Referring to FIG. 3, a flow diagram of an example method 300 formodifying an entry in an event log is depicted. Method 300 begins atblock 310. At block 320, a request to modify an existing entry in anevent log is received at an event log interface. At block 330, theexisting entry is modified. At block 340, it is determined whether theentry meets the criteria to preserve.

If, at block 340, the entry does not meet the criteria to preserve,method 300 proceeds to block 350. At block 350, it is determined whetherthe entry contains an indicator to preserve. If the entry does notcontain an indicator to preserve, method 300 proceeds to block 390 andends. If the entry does contain an indicator to preserve, method 300proceeds to block 360 and removes the indicator to preserve.

If, at block 340, the entry does meet the criteria to preserve, method300 proceeds to block 370. At block 370, it is determined whether theentry contains an indicator to preserve. If the entry contains anindicator to preserve, method 300 proceeds to block 390 and ends. If theentry does not contain an indicator to preserve, method 300 proceeds toblock 380 and adds an indicator to preserve to the entry.

Referring to FIG. 4, a block diagram of an example system 400 formaintaining an event log that retains high value entries. System 400includes one or more clients 410 configured to communicate event entriesto an event log interface 420. Event log interface 420 is configured tomaintain an event log 470 in a storage device 460. Event log interface420 may include received entry module 430, entry deletion module 440,and entry modification module 450. Received entry module 430 may beconfigured to handle received event entries. The received entries may benew entries from clients 410 or may be copies of previous entries.Received entry module 430 may be configured to perform method 100described herein in reference to FIG. 1. Entry deletion module 440 maybe configured to handle deletion of entries in event log 470 to makeroom for another entry. Entry deletion module 440 may be configured toperform method 200 described herein in reference to FIG. 2. Entrymodification module 450 may be configured to modify entries in event log470. Entry modification module 450 may be configured to perform method300 described herein in reference to FIG. 3.

Referring to FIG. 5, a high-level block diagram of an example system forimplementing one or more embodiments of the invention is depicted. Themechanisms and apparatus of embodiments of the present invention applyequally to any appropriate computing system. The major components of thecomputer system 001 comprise one or more CPUs 002, a memory subsystem004, a terminal interface 012, a storage interface 014, an I/O(Input/Output) device interface 016, and a network interface 018, all ofwhich are communicatively coupled, directly or indirectly, forinter-component communication via a memory bus 003, an I/O bus 008, andan I/O bus interface unit 010.

The computer system 001 may contain one or more general-purposeprogrammable central processing units (CPUs) 002A, 002B, 002C, and 002D,herein generically referred to as the CPU 002. In an embodiment, thecomputer system 001 may contain multiple processors typical of arelatively large system; however, in another embodiment the computersystem 001 may alternatively be a single CPU system. Each CPU 002executes instructions stored in the memory subsystem 004 and maycomprise one or more levels of on-board cache.

In an embodiment, the memory subsystem 004 may comprise a random-accesssemiconductor memory, storage device, or storage medium (either volatileor non-volatile) for storing data and programs. In another embodiment,the memory subsystem 004 may represent the entire virtual memory of thecomputer system 001, and may also include the virtual memory of othercomputer systems coupled to the computer system 001 or connected via anetwork. The memory subsystem 004 may be conceptually a singlemonolithic entity, but in other embodiments the memory subsystem 004 maybe a more complex arrangement, such as a hierarchy of caches and othermemory devices. For example, memory may exist in multiple levels ofcaches, and these caches may be further divided by function, so that onecache holds instructions while another holds non-instruction data, whichis used by the processor or processors. Memory may be furtherdistributed and associated with different CPUs or sets of CPUs, as isknown in any of various so-called non-uniform memory access (NUMA)computer architectures.

The main memory or memory subsystem 004 may contain elements for controland flow of memory used by the CPU 002. This may include all or aportion of the following: a memory controller 005, one or more memorybuffer 006 and one or more memory devices 007. In the illustratedembodiment, the memory devices 007 may be dual in-line memory modules(DIMMs), which are a series of dynamic random-access memory (DRAM) chipsmounted on a printed circuit board and designed for use in personalcomputers, workstations, and servers. In various embodiments, theseelements may be connected with buses for communication of data andinstructions. In other embodiments, these elements may be combined intosingle chips that perform multiple duties or integrated into varioustypes of memory modules. The illustrated elements are shown as beingcontained within the memory subsystem 004 in the computer system 001. Inother embodiments the components may be arranged differently and have avariety of configurations. For example, the memory controller 005 may beon the CPU 002 side of the memory bus 003. In other embodiments, some orall of them may be on different computer systems and may be accessedremotely, e.g., via a network.

Although the memory bus 003 is shown in FIG. 5 as a single bus structureproviding a direct communication path among the CPUs 002, the memorysubsystem 004, and the I/O bus interface 010, the memory bus 003 may infact comprise multiple different buses or communication paths, which maybe arranged in any of various forms, such as point-to-point links inhierarchical, star or web configurations, multiple hierarchical buses,parallel and redundant paths, or any other appropriate type ofconfiguration. Furthermore, while the I/O bus interface 010 and the I/Obus 008 are shown as single respective units, the computer system 001may, in fact, contain multiple I/O bus interface units 010, multiple I/Obuses 008, or both. While multiple I/O interface units are shown, whichseparate the I/O bus 008 from various communications paths running tothe various I/O devices, in other embodiments some or all of the I/Odevices are connected directly to one or more system I/O buses.

In various embodiments, the computer system 001 is a multi-usermainframe computer system, a single-user system, or a server computer orsimilar device that has little or no direct user interface, but receivesrequests from other computer systems (clients). In other embodiments,the computer system 001 is implemented as a desktop computer, portablecomputer, laptop or notebook computer, tablet computer, pocket computer,telephone, smart phone, network switches or routers, or any otherappropriate type of electronic device.

FIG. 5 is intended to depict the representative major components of anexemplary computer system 001. But individual components may havegreater complexity than represented in FIG. 5, components other than orin addition to those shown in FIG. 5 may be present, and the number,type, and configuration of such components may vary. Several particularexamples of such complexities or additional variations are disclosedherein. The particular examples disclosed are for example only and arenot necessarily the only such variations.

The memory buffer 006, in this embodiment, may be intelligent memorybuffer, each of which includes an exemplary type of logic module. Suchlogic modules may include hardware, firmware, or both for a variety ofoperations and tasks, examples of which include: data buffering, datasplitting, and data routing. The logic module for memory buffer 006 maycontrol the DIMMs 007, the data flow between the DIMM 007 and memorybuffer 006, and data flow with outside elements, such as the memorycontroller 005. Outside elements, such as the memory controller 005 mayhave their own logic modules that the logic module of memory buffer 006interacts with. The logic modules may be used for failure detection andcorrecting techniques for failures that may occur in the DIMMs 007.Examples of such techniques include: Error Correcting Code (ECC),Built-In-Self-Test (BIST), extended exercisers, and scrub functions. Thefirmware or hardware may add additional sections of data for failuredetermination as the data is passed through the system. Logic modulesthroughout the system, including but not limited to the memory buffer006, memory controller 005, CPU 002, and even the DRAM may use thesetechniques in the same or different forms. These logic modules maycommunicate failures and changes to memory usage to a hypervisor oroperating system. The hypervisor or the operating system may be a systemthat is used to map memory in the system 001 and tracks the location ofdata in memory systems used by the CPU 002. In embodiments that combineor rearrange elements, aspects of the firmware, hardware, or logicmodules capabilities may be combined or redistributed. These variationswould be apparent to one skilled in the art.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present disclosurehave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiments. The terminology used herein was chosen to explain theprinciples of the embodiments, the practical application or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed herein.

What is claimed is:
 1. A computer program product for managing an eventlog, the computer program product comprising a non-transitory computerreadable storage medium having program code embodied therewith, theprogram code executable by one or more processors to perform a methodcomprising: receiving a first entry at an event log interface, the eventlog interface configured to store received entries in an event log;determining the first entry is not a copy of a previous entry based onthe first entry not containing an indicator to preserve, wherein theindicator to preserve is a specific string of one or more characters;adding, in response to the determining the first entry is not a copy, afirst timestamp to the first entry, determining there is not enoughstorage space to store the first entry in the event log; identifying asecond entry, the second entry an oldest entry in the event log based onwhen the second entry was written to the event log, the second entryincluding a second timestamp indicating when an original entry for anevent associated with the second entry was first received at the eventlog interface; determining the second entry contains the indicator topreserve; determining a first period of time since the event occurred isnot greater than a specified period of time, the first period of timebased on the second timestamp; determining the event log has less than aspecified amount of storage space containing entries with the indicatorto be preserved; sending, based on the determining the first period oftime is not greater than the specified period of time and based on thedetermining the event log has less than the specified amount of storagespace containing entries with the indicator to be preserved, a copy ofthe second entry to the event log interface to be written to the eventlog, the copy of the second entry including the second timestamp;deleting one or more entries from the event log, the one or more entriesincluding the second entry; writing the first entry to the event log;determining the first entry meets criteria to preserve based on an eventassociated with the first entry being included in a list of events topreserve; adding, in response to the determining the first entry meetscriteria to preserve, the indicator to preserve to the first entry;receiving the copy of the second entry at the event log interface;determining, in response to the receiving the copy of the second entry,the copy of the second entry is a copy of a previous entry based on thecopy of the second entry containing the indicator to preserve; writingthe copy of the second entry to the event log, the copy of the secondentry containing the second timestamp; modifying the first entry in theevent log; determining, based on the modifying the first entry, thefirst entry no longer meets criteria to preserve; and removing, inresponse to the determining the first entry no longer meets criteria topreserve, the indicator to preserve from the first entry.